TABLE OF CONTENTS DR IMPLEMENTATIONS:... DRAAS:... DR BUDGETS:... INTRODUCTION:... KEY FINDINGS:... PREPARATION:... COMPLIANCE:... CONCLUSION:...

Transcription

1

2 TABLE OF CONTENTS INTRODUCTION:... KEY FINDINGS:... PREPARATION:... COMPLIANCE:... DR IMPLEMENTATIONS:... DISASTER EXPERIENCES:.. DR/BC PLANS:... DRAAS:... DR BUDGETS:... CONCLUSION:

3 INTRODUCTION: Hollywood is full of epic disasters. After all, what creates more tension and drama than a crisis, particularly one with dire consequences? Money, lives and jobs are continually at stake on the screens of your choice. Of course unlike a Hollywood outcome, in real life, when there s a disaster with your business, there s never a truly happy ending. The best case scenario is that things return to normal after a tremendous amount of time, money and other personnel resources have been spent. Add in the angst and tension that were created before your small screens got back up to speed and you ve got a scene you ll never want to see again. With those thoughts in mind, we conducted an IT Disaster Recovery & Business Continuity Survey with 2,084 executive and IT professionals. Evolve IP s 2015 Disaster Recovery & Business Continuity Survey examined the disaster preparedness and DR/BC trends in North American organizations. Specifically we looked at: Organizations experiences with outages and related incidents What organizations are doing for Disaster Recovery/Business Continuity DR / BC today DR/BC plan contents Disaster Recovery-as-a-Service (DRaaS) DR budgets Fifty-three point five percent of the respondents were from organizations with between 100-2,000 employees; 25 percent from organizations with between employees; 16.5 percent from organizations with more than 2,000 employees and 5 percent from organizations with 1-10 employees. 2

4 KEY FINDINGS: Less than half (45.5 percent) of those surveyed believe they are very prepared to recover their IT assets in the event of a disaster. In fact, four percent are not prepared at all and 50.5 percent are only somewhat prepared. Meanwhile, 64 percent stated that business continuity or disaster recovery is a compliance requirement for their organization. The findings also show that those with compliance requirements are more conscientious about DR and therefore fair better during incidents, as well as in recovering from them. Sixty-six percent of respondents that have both compliance requirements and a DRaaS solution consider themselves very prepared to recover from an incident, versus only 31.5 percent of those who do not have compliance requirements and DRaaS. The leading cause of incidents and outages is: hardware failure / server room issues (47 percent). The next leading cause is environmental disasters (such as flood, fire, ice storm, etc.), with 34.5 percent and the third is other miscellaneous outages at 27.5 percent. Several data points bring us to the conclusion that educational institutions are clearly the least prepared for disaster recovery, and that they don t have the proper budget to develop the most effective DR/BC plan. For example, only 25.5 percent of educational institutions consider themselves very prepared to recover from a disaster or incident. 3

5 PREPARATION Of those surveyed, 50.5 percent believe they are only somewhat prepared to recover their IT and related assets in the event of a disaster or other incident. Ability to Recover IT & Related Assets in event of disaster or incident 50.5 % 45.5% 4% Somewhat Prepared Very prepared Not prepared As expected, a higher percentage (54 percent) of those for whom compliance is a requirement say they are very prepared to recover from a disaster than those without compliance requirements (just 31.5 percent). It is clear from the results of the survey that compliance is a major driver for Disaster Recovery. Ability to Recover: Organizations with Compliance Requirements With Compliance requirements Very Prepared Somewhat Prepared Not Prepared 54% 44% 2% without compliance requirements 31.5% 61% 7.5% 4

6 When looking at the types of DR in place, those with DRaaS ultimately felt the most prepared. Ability to Recover: Organizations with DRaaS Solutions 62.5% Very Prepared 36.5% 1% Somewhat Prepared Not Prepared Similarly, 56 percent of those organizations with their DR in a hosted or MSP environment feel very prepared. Ability to Recover: Organizations with DR in a Hosted or MSP Environment NOT Prepared Somewhat Prepared Very Prepared 5

7 When comparing those companies that are both adhering to compliance requirements and who utilize DRaaS against those who do not, we see a drastic difference in preparedness. In fact, the number of compliant respondents with DRaaS who claim to be very prepared is more than double that of those who don t have compliance requirements and DRaaS (31.5 percent.) Additionally, none of the compliant respondents with DRaaS claimed to be not prepared, while seven and a half percent of those who don t have compliance requirements or DRaaS feel that they are not prepared. Ability to Recover: Organizations with Compliance Requirements and DRaaS vs. those without HAVE COMPLIANCE and DRaaS DO NOT HAVE COMPLIANCE or DRaaS 7.5% 66% 34% 61% 31.5% = Very Prepared = Somewhat Prepared = Not Prepared On the flip side, we noted that educational institutions are far less confident in their preparedness, with just 25.5 percent saying they are very prepared. Ability to Recover: Focus on Organization Types Very Prepared Somewhat Prepared Not Prepared For Profit 45% 51% 4% Not for profit 39.5% 57% 3.5% Educational 25.5% 69% 5.5% Government 44.5% 53% 2.5% 6

8 COMPLIANCE Compliance refers to the steps organizations have to take in order to comply with relevant rules and regulations, often specific to their industry, such as adhering to HIPAA regulations in healthcare. Of those surveyed, 64 percent stated that business continuity /disaster recovery is a compliance requirement for their organization. As expected, larger organizations are more likely to have compliance requirements for DR/BC. However, it is important to note that nearly 60 percent of organizations with employees have compliance requirements as well. THE VERDICT 60% OF ORGANIZATIONS WITH EMPLOYEES HAVE COMPLIANCE REQUIREMENTS NOW PLAYING Organizations with Compliance Requirements for DR/BC: company size COMPANY SIZE 1-10 Employees Employees 100-2,000 Employees 2,001-5,000 Employees Over 5,000 Employees HAVE COMPLIANCE 32% 55.5% 64% 67% 84.5% 7

9 DR IMPLEMENTATIONS Five percent of those surveyed have no DR implementation of any kind. Forty-five percent are using backup tapes as their DR implementation and 41.5 percent are using additional servers and devices at their primary site for DR. These legacy methods are worrisome, when more advanced and reliable options are available. There are potential flaws in some of the other high-ranking approaches as well: Onsite replicated data center 41.5 percent: Replicating data centers in the same location provides little security against environmental disasters. Additionally, hardware failures in that data center are likely, considering hardware failure ranked as the highest culprit among those that experienced a loss. Secondary mirror site 41 percent: While this is a better approach, many are not moving far enough away. In fact, 35 percent have their DR site less than 100 miles away making it more likely that both sites would be impacted in the event of a major environmental disaster. Public Cloud 13 percent: Although it is not as high-ranking, it is concerning to note that 13 percent are using public cloud as an approach to DR. The majority are not yet utilizing approaches that many consider best practice for effective DR, such as a DRaaS solution from a service provider (6 percent); or DR in a hosted or MSP environment (15 percent). Approaches to DR / BC Implementation NEW RELEASES 34% Software Replication 32.5% High Availability Hardware/Software 30% Secondary Site Different than Primary 28% Hardware Replication 26% Data/Application Mirroring 15% Hosted or MSP Environment PUBLIC CLOUD IS UNRELIABLE 6% DRaaS Solution 8

10 Because such a large percentage claimed to be using backup tapes for DR, we focused on that group to see what other methods, if any, they were utilizing. Again, we note a lack of best practices. Even though the majority of those using backup tapes are using some other method(s), the most common is additional equipment at the same, primary site. Without geographical diversity, this method will be virtually useless if there is a flood or other disaster that affects that location. additional Approaches to DR/BC: organizations using backup tapes Use Software based replication Use additional servers & devices at primary site Have secondary site 9

11 Of those that are utilizing a secondary site, 20 percent stated that it is less than 25 miles away from the primary data center and another six percent don t know the distance from their primary site. This is concerning, given that a natural disaster such as a major storm would likely cause the same degree of flooding, ice damage, high winds, etc. in both locations. The advantage of having a secondary site is to be able to keep your backups in a location that would not be prone to the same disasters as your main location. 25.5% do not have a backup data center. While 19 percent of those organizations that have compliance requirements do not have a backup data center, it is far better than those without compliance requirements, at 38.5 percent. Those with compliance requirements also have the higher percentage with their backup data center being further than 1000 miles away from the primary site (17 percent, versus 7.5 percent). Distance between Main and Secondary Data Centers: Organizations with Compliance Requirements Further than 1000 Miles Do Not Have Backup Center Have Compliance 17% 19% do not have compliance 7.5% 38.5% 10

12 One of the more concerning data points we noted was that nearly half of the government agencies that have a secondary site (46 percent) have it less than 25 miles from the main site. Organizations with Secondary Data Center Less Than 25 Miles from Main Site Government Education Not for Profit For profit Other 46% 27.5% 23% 16% 11.5% <25 MILES DATA CENTER #2 DATA CENTER #1 11

13 disaster experiences More than one-third (34.5 percent) of companies claim to have suffered from at least one incident or outage that required disaster recovery. While that is a significant number, it also tells us that the majority of the organizations surveyed have not yet really put their DR solutions and plans to the test. 65.5% HAVE NOT ORGANIZATIONS THAT HAVE EXPERIENCED INCIDENTS REQUIRING DR 34.5% HAVE Of those who have suffered an outage or incident, over four in 10 have had multiple incidents in the past five years. ORGANIZATIONS THAT HAVE EXPERIENCED MULTIPLE INCIDENTS 1% 27% 10% 3 INCIDENTS 4% MORE THAN 5 INCIDENTS 2% 4 INCIDENTS 5 INCIDENTS 2 INCIDENTS 12

14 The leading cause of incidents / outages is hardware failure / server room issues (47 percent). The next leading cause is environmental disasters (such as flood, fire, ice storm, etc.), with 34 percent. It s also interesting to note that 18.5 percent stated that human error was the cause of their organization s incidents or outages. CAUSES OF INCIDENTS & OUTAGES 47% : A HARDWARE OUTAGE 34% Environmental Disaster 27.5% Other Misc. Power Outages 18.5% Human Error 15% Software Failure 8.5% Backup Failure 6.5% Deliberate Attack 13

15 Thirty-four and a half percent stated that their recovery from such incidents took up staff time that impacted their business. Just over 1 in 10 organizations (11 percent) experienced permanent losses. One quarter stated that they had to alter their DR plans as a result of the incident, indicating that many plans are not strong when initially conceived. BUSINESS IMPACT Effects of Incidents & Outages on Organizations 34.5% - Recovery took up staff time 25% - Altered DR plan as a result 16% - Changed DR test plan procedures/frequency 13% - Partially recovered 11.5% - Suffered from some permanent losses When comparing the different types of organizations, educational institutions clearly fared far worse than other types when experiencing a disaster, with 28 percent suffering permanent losses. Government agencies also suffered higher permanent losses than the average, at 14.5 percent. Effects of Incidents & Outages: Focus on Organization Type Some permanent losses Recovery took up staff time For Profit 10.5% 32.5% Not for Profit 10.5% 38% Educational 28% 44% Government 14.5% 38% 14

16 As you would expect, the associated financial losses resulting from incidents or outages scaled up with the size of the business. Costs Associated with Organizations Worst DR Event: Company Size 22 percent with 10 or less employees experienced losses more than $5, percent with 11 to 99 employees experienced losses of more than $10, percent with 100 to 2,000 employees experienced losses of more than $20, percent with 2,001 to 5,000 employees experienced losses of more than $50, percent with more than 5,000 employees experienced losses over $100,000. NOTES IP Eighteen and a half percent of organizations with more than 5,000 employees experienced losses in the $50,000 to $100,000 range. Noting their most serious incident, it took more than one business day for 52.5 percent of organizations to recover their organization s IT operations. With over half of organizations going down for more than a day, it is clear that when a disaster hits, it hits hard and it s difficult to recover from quickly. Time to Recover from Organizations Worst DR Event More than one business day 52.5% Less than one business day 47.5% 15

17 Again, we see that those with compliance requirements are getting better results in their DR. While it took 48.5 percent of those with compliance requirements more than one business day to recover from their most major incident, it took more than one business day for 61 percent of those without compliance requirements. Time to Recover from Organizations Worst DR Event: Organizations with Compliance Requirements One Business Day or Less More than One Business Day Have Compliance Requirements 51.5% 48.5% Do Not Have Compliance Requirements 39% 61% When comparing types of organizations, we noted that educational institutions and not for profit organizations had the highest percentages that took more than one business day to recover from their most major incident. Time to Recover from Organizations Worst DR Event: Organization Type More than One Business Day Not for Profit 61% Educational Institution 62.5% 16

18 More than half of those who have experienced an incident have lost data, with 12 percent losing more than one day s worth of data. Hours of Data Lost Less than one hour 1-5 Hours 6-10 Hours Hours Hours More than one day DANGER! Those who have compliance requirements fared better, with 54 percent experiencing no loss, while just 37 percent of those with no compliance requirements avoided loss. Again, we note that educational institutions fare worse than other types of organizations, with 31.5 percent losing more than one day s worth of data during their worst incident. 17

19 When looking at the types and durations of losses during incidents, we see that the highest percentage of permanent loss was that backups were not recoverable, followed by loss of critical data. The highest percentages of losses for one or several days were loss of network connectivity, loss of a host machine and loss of a critical application. Types and Durations of losses Permanent Loses lost For Days lost for One Day 6% Backups Were Not Recoverable 5% Lost Critical Data 12.5% Lost One Host Machine 11.5% Lost One Critical Application 11.5% Lost Network Connectivity 40% Lost Network Connectivity 27% Lost One Host Machine 26.5% Lost One Critical Application 18% Lost One Virtual Machine 15% Lost Multiple Virtual Machines 18

20 DR /BC PLANS About three-quarters (74 percent) of those surveyed say that their organizations have implemented a DR/BC plan. Organizations that Have Implemented DR Plans 74% - Have Implemented 26% - Have NOT Thirteen and a half percent of those who have compliance requirements have not implemented a DR / BC plan. Meanwhile, nearly half of those without compliance requirements (48 percent) do not have a DR / BC plan implemented. Organizations that Have Implemented DR Plans: organizations with compliance requirements Have Compliance requirements No Compliance Requirements Have a DR/BC Plan Don t have a DR/BC Plan 86.5% 13.5% 52% 48% 19

21 Of those organizations that do have a DR / BC plan implemented, 17.5 percent of them claim that the plan was created due to a previous disaster, incident or outage. Percentage of DR Plans Created Due to a Previous Incident 82.5% did not create plan due to prior disaster 17.5% created plan due to previous disaster 20

22 Of those with a DR plan, just under three-quarters (73.5 percent) of them document Recovery Time Objectives (RTOs) and 10.5 percent were not familiar with the term before taking our survey. DEFAULT RECOVERY TIME OBJECTIVES (RTOS) IN DR PLANS Even more (15.5 percent) were not familiar with Recovery Point Objectives (RPOs) and just 67 percent are documenting RPOs in their DR plan. 21

23 , DRAAS MARK NO 41 % YES 59 % PARTICIPANTS FAMILIAR WITH DRAAS BEFORE TAKING SURVEY, DRAAS MARK Disaster Recovery-as-a-Service (DRaaS) is a cloudbased service that provides organizations with data loss prevention and business continuity options. 41 percent of those surveyed were not familiar with the term Disaster Recovery-as-a-Service (DRaaS) before taking the survey. Once the term had been defined, the majority of respondents noted they are either considering adding a DRaaS solution (52 percent) or already have a DRaaS solution (16 percent). Based on the results noted earlier for those with DRaaS, we expect as those services are implemented that preparedness, loss and compliance numbers will improve over time % 17 HOW LONG BEFORE PARTICIPANTS WILL IMPLEMENT A DRAAS SOLUTION % % 32.5% % 25% DIRECTORY Already have 0-12 MONTHS 1-3 Years 3+ Years NEVER Stop by the gift shop to download our complimentary DRaAS Data Sheet CLICK IP Take The award-winning Evolve IP DRaaS solution provides a dependable suite of products designed to meet the recovery needs of your business. We offer a wide range of RPO and RTO service levels with RPOs measured in seconds, not hours. We also feature a fully automated failover and failback process with a flexible, self-service portal. Leveraging world-class partners like EMC, VMWare and Microsoft, Evolve IP designed its DRaaS suite to allow businesses to determine their level of risk and spend accordingly. 22

24 educational organizations Permanent losses are hitting educational institutes harder than other Permanent types Losses: of organizations Focus on Educational with Institutions 15.5 percent as Compared losing to Other critical data permanently and 15.5 percent Organization not Types being able to recover backups. Permanent Losses: Educational Institutions 15.5% % Lost Critical Data 15.5% % Backups were not recoverable Not surprisingly, educational institutions have the lowest percentage (62 percent) that say they have a DR / BC plan implemented. Given that they seem to be faring worse than other types of organizations when disaster strikes, it seems clear that they need to seriously consider developing and implementing DR / BC plans. DR Plans Implemented: Educational Institutions 62% Just 62 percent%of educational institutions have a DR / BC plan implemented 23

25 As evidenced by the losses and general lack of best practices compared to their for profit counterparts, a higher percentage of educational institutions think that their DR budget is underfunded (57.5 percent) than other types of organizations, with government agencies just seven and a half percentage points in front of them. Organizations with Sufficiently Funded DR Budgets: Organization Type For Profit Company Not for profit Organization Educational Institution Government Agency Sufficiently Funded Underfunded Too Much Budget allocated to DR 63% 36.5%.5% 55.5% 43.5%.5% 42% 57.5%.5% 50% 50% 0% 24

26 DR BUDGETS The majority of respondents (54.5 percent) spend less than $50,000 annually on DR and BC and another eight percent spend no money at all on DR and BC. Annual Amount Spent on DR/BC 54.5% - Less than 50k 16% - $50k - $100k 13.5% - $100k - $500k 8% - $0 As expected, larger organizations are spending more on their annual DR / BC budget. It is notable that 13.5 percent of companies with 2,001 to 5,000 employees spend more than $1 million on DR and 29 percent of those with more than 5,000 employees are also spending more than $1 million. A concerning statistic is that nearly 9.5 percent of respondents in organizations with 2,001 to 5,000 employees have no budget at all designated to DR. Those with compliance requirements are spending more on DR / BC planning. In fact, 46.5 percent spend $50,000 or more annually on DR / BC, while only 22 percent of those without compliance requirements spend the same percent of companies with 2,001 to 5,000 employees spend more than ONE MEEELION DOLLARS on Disaster Recovery Dr. Budget 25

27 Almost half of those surveyed (45 percent) are allocating one to five percent of their IT budget on DR and about one in 10 are not allocating any of their IT budget at all to DR. A mere two percent are allocating more than 20 percent of their IT budget to DR. One in ten Have $0 dedicated to DR/BC 45% % Have 1-5% of their annual budget dedicated to DR/BC Thirty-nine percent of those surveyed claimed that their IT Disaster Recovery budget is UNDERFUNDED Sufficiency of DR Budget funding % 60% 1 % % 39% = Underfunded = Sufficient Funding = Too Much Allocated Nearly half (47.5 percent) of those who do not have compliance requirements feel that their DR IT budget is underfunded, while 33.5 percent of those with compliance requirements feel their organization s DR budget is underfunded. Sufficiency of DR Budget funding : Organizations with Compliance Requirements Sufficiently Funded Underfunded Too Much budget allocated to DR Have Compliance Requirements 66% 33.5%.5% do not have Compliance Requirements 51.5% 47.5% 1% 26

28 CONCLUSION: Whether you are preparing for a great flood like Russell Crowe in Noah, facing full on Armageddon like Bruce Willis and Ben Affleck, or racing the clock like Jack Bauer, today s IT professionals have the opportunity to save their organizations from disaster. Based on the results of the 2015 Evolve IP Disaster Recover & Business Continuity Survey it is clear that there will be opportunities to take on that hero role. The survey results tell us that most organizations believe they are taking steps needed to be prepared for disaster with the overwhelming majority feeling somewhat or very prepared. However, their assurances are likely misplaced as many of the business continuity and recovery plans and approaches noted, like backup tapes, are generally weak. Because hardware failure / server room issue is the leading cause of incidents, organizations claiming to use additional servers and devices at their primary site for DR should also consider a better DR option. Additionally, more than a quarter of those who claim to have a DR/BC plan are not including RTOs and RPOs in their plans a critical component of an effective plan. With 65.5 percent of organizations not yet experiencing a disaster, we realize that most of the organizations that have DR/BC plans have not truly had the opportunity to test their plans effectiveness. Sixty-four percent stated that business continuity or disaster recovery is a compliance requirement for their organization, and the results illustrate that this group appears to fair better during incidents, as well as in recovering from them. This leads us to the conclusion that compliance is a strong driver for DR/BC, perhaps even more than concern over the effects of a disaster for many businesses. Educational institutions are clearly the least prepared for disaster recovery, and they feel they don t have the proper budget to develop the most effective DR/BC plan. Those with compliance requirements and a DRaaS solution are the most confident in their ability to recover from a disaster. With over half of respondents indicating that they will consider moving to a DRaaS solution in the next three years, we expect to see solid improvements in confidence, recovery time and permanent losses in future studies. Additional gains should also be made as more companies adopt compliance regulations that include DR. 27